Role in IT decision-making process:Align Business & IT GoalsCreate IT StrategyDetermine IT NeedsManage Vendor RelationshipsEvaluate/Specify Brands or VendorsOther RoleAuthorize PurchasesNot Involved

Work Phone:

Company:

Company Size:

Industry:

Street Address

City:

Zip/postal code

State/Province:

Country:

Occasionally, we send subscribers special offers from select partners. Would you like to receive these special partner offers via e-mail?YesNo

Your registration with Eweek will include the following free email newsletter(s):News & Views

By submitting your wireless number, you agree that eWEEK, its related properties, and vendor partners providing content you view may contact you using contact center technology. Your consent is not required to view content or use site features.

By clicking on the "Register" button below, I agree that I have carefully read the Terms of Service and the Privacy Policy and I agree to be legally bound by all such terms.

The malware is linked to the infamous Zeus Trojan, a common tool used in the theft of banking credentials. The phony security applications were first observed earlier this month, and newer versions have continued to appear, according to Kaspersky.

"On the 4th of June 2012 we found 3 APK files of ~207 kb in size each heuristically detected by our engine as HEUR:Trojan-Spy.AndroidOS.Zitmo.a," blogged Kaspersky researcher Denis Maslennikov. "All these applications are malicious and were created to steal incoming SMS messages from infected devices. SMS messages will be uploaded to a remote server whose URL is encrypted and stored inside the body of the Trojan."

The company found three more APK (application package) files with exactly the same functionality on June 8, 13 and 14. All totaled, there are at least six files that pretend to be Android Security Suite Premium, but in actuality steal incoming SMS messages, the researcher said. The point of stealing incoming SMS messages is to swipe the victim's mobile transaction authentication number (mTAN), which is used by banks to authenticate online bank transactions. When a device is infected, the SMS messages are uploaded to a remote server.

Further reading

"One of the remote server domains was registered using the same fake data which was used for registering ZeuS C&Cs [command and control] servers back in 2011," Maslennikov blogged. And the malwares functionality is almost the same as in old ZitMo samples [the mobile version of Zeus]. Therefore Android Security Suite Premium = New ZitMo."

The issue of Android malware has been a focus of security researchers and attackers alike for the past year. Last week, Sophos released its list of the five most common pieces of Android malware. The most prevalent is what the company refers to as Andr/PJApps-C, which Sophos Senior Technology Consultant Graham Cluley described as an application that has been cracked using a publicly available tool that may or may not be actually malicious. The second most popular is BaseBridge, which uses a privilege escalation exploit to elevate its privileges and install additional malicious apps onto a victim's device. It also uses HTTP to communicate with a central server and leaks potentially identifiable information.

On June 13, authorities in Japan arrested six men for distributing a malicious Android app through a Website that hosted adult content. According to The Daily Yomiuri, the Trojan was hidden inside an application that posed as a video player. Once opened, the malware stole the victim's information and sent it to a remote server. The application also displayed a message demanding a payment of 99,800 yen. Symantec detects the rogue application as Android.Oneclickfraud.

"While there are countless numbers of sites aimed at scamming computer users, there have only been a handful of sites designed for smartphones to date," blogged Joji Hamada, threat analyst with Symantec Security Response. "Out of those, we are aware of at least two sites affiliated with the site operated by the arrested men, and they are up and running¦. So, with the arrest of the gang operating Android.Oneclickfraud I am hopeful that their sister sites will be taken down soon, with more arrests to follow. However, at the time of writing they show no sign of letting up."